Digital Services Project – Review

City of York Council

Internal Audit Memo

Service Area: Corporate Responsible Officer: Assistant Director: Customer Services and Digital Date Issued: 14/3/2017 Status: Final Introduction and scope

1.1 The Executive approved plans for a new smart and responsive online service which will improve access for residents, visitors and businesses at the Executive meeting on Thursday 11 February 2016.

1.2 The first stage of the programme is to improve users' online experience with the council, with the new Customer Relationship Management (CRM) system aiming to:

- Provide online access to more services and information.
- Ensure the council is more efficient and easy to do business with on a 24/7 basis.
- Implement a ‘My Account’ system for residents offering a tailored access to council services.
- Provide access via mobile devices and tablets, increasing accessibility for residents and other customers.
- Allow residents and customers to track the progress of their requests and receive updates.

1.3 The programme is following the council's approved project management guidelines as its framework. The purpose of this audit was to provide assurance to management that procedures and controls within the project management system will ensure that:

- Project management principles have been applied to the programme of work and specific projects
- Governance arrangements are in place and are at the correct level for the programme
- Risk management is considered and reviewed throughout the programme

1.4 This audit was a desktop exercise and reviewed only information received by the Project Board. An initial review was carried out in July 2016 and feedback was provided. A follow-up was then carried out and this report summarises both pieces of work. Veritau has also attended Board meetings since July in order to provide support, challenge and advice.

Findings

2.1 Project Board information from January 2016 was reviewed for this audit. All project documents were available within the specific folders on the council’s network. There was a clear folder structure and most documents were clearly labelled. Project Management Arrangements

2.2 There is a designated project team with a clear mandate and a project plan in place. This was all confirmed prior to the review period but is evidenced throughout the documentation.

2.3 The project is monitored through the meetings of the Project Board which occur at regular intervals (currently monthly) and the Project Board meetings are minuted and supported by documentation in line with those outlined within the All About Projects framework including highlight reports.

2.4 The highlight report gives the current status of the project. There is an approved communications plan and all key stakeholders have been invited to attend the Project Board meetings.

Governance Arrangements

2.5 There is a clear governance structure in place for the project. There is a formal Project Board which has an approved Terms of Reference. The Project Board represents all council services. It provides a governance mechanism for managing the project providing assurance and reporting upwards to council’s management team, Scrutiny and Executive.

2.6 The Project Board has also formally assigned the role of project assurance to the Programme Manager and they attend the Project Board meetings.

2.7 The project has documented this governance structure and has made provision for any time when board meetings do not align to key decision points. The chair of the Project Board has, on those occasions, been delegated the following powers which would be ratified at the next board meeting:

- To approve budget spend above £10,000.
- To approve changes to the project milestones and scope.

2.8 It was suggested during the initial review that, it would be good practice to have at least three Project Board members (including project assurance) to take these decisions outside of the normal meetings, thereby the decisions are still subject to challenge by key board members. In November, the chair invited key stakeholders to an extra meeting to make a decision on the deployment for the release for Street lighting and Street Cleaning (a Go Live decision). The decision was made with a number of caveats – a copy of which was circulated to the full Project Board.

2.9 Minutes are produced for each board meeting and they are reviewed at the next board meeting for accuracy. The review found that the content of the minutes could be improved. The following main issues were identified: • The minutes were not produced on a timely basis.

On the two occasions the minutes were requested after the Project Board (July and November), they were not available for over three weeks. This has an impact on the project team who are required to check their accuracy and use them to inform the current project papers before circulating them to the Project Board before the next meeting.

• The minutes do not include an action log (nor is one maintained separately).

There is therefore no formal mechanism for ensuring that all actions arising from the board meetings were completed. Questions raised within the minutes are not always answered in subsequent minutes or supplementary papers and information that was to be sought outside of the Project Board meeting is not always brought back to the Project Board at the next meeting, and therefore not followed up for the completeness of records. These issues would be resolved by the implementation of an action log.

• Decisions were not always formally recorded within the minutes and the basis on which the Project Board has made decisions was not always articulated or cross referenced to the supporting papers.

A decision log was implemented in July and going forward attention will be placed on the wording of the decisions so that the articulate the specifics of what the board has agreed to.

• It was not clear which documents had been circulated or presented to the Project Board.

There were a number of versions of some documents available within the project folders at the time of review. Not all documents had been saved as a PDF version with an appropriate label.

Risk Management Arrangements

2.10 The project actively monitors risk and discussions are held at the Project Board meetings. There are project specific risk registers (Phase One and Release Two) which were refreshed in October 2016. The risk registers are maintained through the Council’s risk management system – Magique. This ensures that the corporate risk management matrix is used and that specific fields are completed.

2.11 The risk register which was presented to the Project Board in January 2016 did not document the gross and net risks for the project – however this has been corrected and the current registers display both the gross and net risk scores. 2.12 Risks are updated as and when required but the formal registers are being brought back to the Project Board on a bi-meeting basis. As the format of the risk register is quite static, the Project Board has recently requested that all ongoing changes are highlighted. This will allow them to quickly acknowledge any amendments within the controls and actions for the specific risks.

2.13 An issues log for Phase One of the project has been established. This is presented to the board along with the risk registers. It should be noted that the critical success factors for the project have been documented and are monitored within the project.

Conclusions and Recommendations

3.1 It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement. Our overall opinion of the controls within the project at the time of the review was that they provided **Substantial Assurance**.

The key areas for improvement are:

- The quality and timeliness of the meeting minutes should be addressed. The review has confirmed that whilst discussions take place at the board meetings and decisions made, they are not always accurately reflected in the minutes.

- An action tracking mechanism within the meeting minutes or an action log should be maintained. This should be updated after all Project Board meetings to ensure that all actions are reviewed to ensure that they are actioned.

- The decision log should be revised to ensure that it only contains decisions made at the board meetings (and not actions) and that the wording of the decisions articulates the decision made by the board.

Further work

4.1 Veritau will continue to attend the Project Board meetings and will confirm that the agreed actions have been completed.

Management Response

5.1 The issues identified above were raised constructively at the time so we could take some remedial action. The agreed actions can be seen in Appendix 1.

## Action Plan

| Action Number (Ref 3.1) | Issue | Risk | Agreed Action | Priority | Responsible Officer | Timescale | |-------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|-------------------------------------------------------------------------------------|------------------------------------------------| | 1 | The minutes are not produced on a timely basis. | Information may be lost or recorded incorrectly. | The quality and timeliness of the meeting minutes has been addressed. A project resource will continue to produce the minutes with the support of the project manager, who will record all actions/decisions made for the respective logs. The aim is to have minutes produced within 3 working days of the meeting. | 2 | Project Sponsor (Assistant Director: Customer Services and Digital) | COMPLETED In effect from December 2016 meeting | | 2 | The minutes do not include an action log (nor is one maintained separately). | Actions and outcomes may be lost, not followed up or reported back to the board. | An action log has been introduced. This cross references to any actions made within the meeting minutes and included timescales, responsible office and timescales. The action log will be reviewed at the start of each meeting with the previous meetings minutes. | 3 | Project Sponsor (Assistant Director: Customer Services and Digital) | From March 2017 meetings | | 3 | Decisions are not always formally recorded within the minutes and the basis on which the Project Board has made the decisions was not always articulated or cross references to the supporting papers. | Decisions may not be recorded accurately. | The decision log has been revised to ensure that it accurately reflects and contains all decisions made at the board meetings (and not actions). The format has changed so that key information is captured within the log | 3 | Project Sponsor (Assistant Director: Customer Services and Digital) | From March 2017 meetings | \*The priorities for actions are:

Priority 1: A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management.

Priority 2: A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management.

Priority 3: The system objectives are not exposed to significant risk, but the issue merits attention by management.

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.